Spyware, viruses, & security forum: VULNERABILITIES - December 20, 2006

TITLE:
CA Portal Technology Session Handling Vulnerability

SECUNIA ADVISORY ID:
SA23426

VERIFY ADVISORY:
http://secunia.com/advisories/23426/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
From local network

SOFTWARE:
CA Unicenter Workload Control Center 1.x
http://secunia.com/product/12932/
CA Unicenter Management Portal 3.x
http://secunia.com/product/3936/
CA Unicenter Management Portal 2.x
http://secunia.com/product/3937/
CA Unicenter Enterprise Job Manager 1.x
http://secunia.com/product/5588/
CA Unicenter Database Management Portal 11.x
http://secunia.com/product/12931/
CA Unicenter Database Command Center 11.x
http://secunia.com/product/12928/
CA Unicenter Asset Portfolio Management 11.x
http://secunia.com/product/7125/
CA eTrust Security Command Center 8.x
http://secunia.com/product/12927/
CA eTrust Security Command Center 1.x
http://secunia.com/product/3693/
CA CleverPath Portal 4.x
http://secunia.com/product/6404/
CA CleverPath Aion 10.x
http://secunia.com/product/5582/
CA BrightStor Portal 11.x
http://secunia.com/product/5577/
CA Unicenter Management Portal 11.x
http://secunia.com/product/12933/

DESCRIPTION:
A vulnerability has been reported in CA's Portal technology, which
potentially can be exploited by malicious users to bypass certain
security restrictions.

The problem is that when multiple Portal servers share a common data
source, a malicious user may be be able to inherit the session and
security authentication of another user from a different Portal
server.

SOLUTION:
Apply patches.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp

TITLE:
Sun Java JRE Applet Security Bypass

SECUNIA ADVISORY ID:
SA23398

VERIFY ADVISORY:
http://secunia.com/advisories/23398/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
From remote

SOFTWARE:
Sun Java JDK 1.5.x
http://secunia.com/product/4621/
Sun Java JRE 1.5.x / 5.x
http://secunia.com/product/4228/
Sun Java JRE 1.4.x
http://secunia.com/product/784/
Sun Java JRE 1.3.x
http://secunia.com/product/87/
Sun Java SDK 1.4.x
http://secunia.com/product/1661/
Sun Java SDK 1.3.x
http://secunia.com/product/1660/

DESCRIPTION:
Two vulnerabilities have been reported in Sun Java JRE (Java Runtime
Environment), which can be exploited by malicious people to bypass
certain security restrictions.

The vulnerabilities are caused due to unspecified errors in the Java
Runtime Environment and may allow a malicious, untrusted applet to
access data in other applets.

The vulnerabilities are reported in the following versions:
* JDK and JRE 5.0 Update 6 and prior
* SDK and JRE 1.4.2_12 and prior
* SDK and JRE 1.3.1_18 and prior

SOLUTION:
Update to fixed versions.

JDK and JRE 5.0:
Update to JDK and JRE 5.0 Update 7 or later.
http://java.sun.com/javase/downloads/index_jdk5.jsp

SDK and JRE 1.4.x:
Update to SDK and JRE 1.4.2_13 or later.
http://java.sun.com/j2se/1.4.2/download.html

SDK and JRE 1.3.x:
Update to SDK and JRE 1.3.1_19 or later.
http://java.sun.com/j2se/1.3/download.html

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Tom Hawtin.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1

TITLE:
PHP-Update blog.php Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA23407

VERIFY ADVISORY:
http://secunia.com/advisories/23407/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Manipulation of data, System access

WHERE:
From remote

SOFTWARE:
PHP-Update 2.x
http://secunia.com/product/12926/

DESCRIPTION:
rgod has discovered some vulnerabilities in PHP-Update, which can be
exploited by malicious people to bypass certain security restrictions
and by malicious users to compromise vulnerable systems and manipulate
data.

1) The security bypass vulnerability is caused due to an insecure
authentication method in blog.php. This can be exploited to bypass
authentication and post blog entries by passing the value "1" to the
parameters "adminuser" and "permission".

2) Input passed to the "newmessage" parameter in blog.php is not
properly sanitised before being written to a web-accessible file.
This can be exploited to execute arbitrary PHP code.

Successful exploitation requires valid user credentials (but see 1).

3) Input passed to the "f" parameter in blog.php is not properly
sanitised before being used to write files. This can be exploited to
create and overwrite arbitrary files with the file extension ".php"
via directory traversal attacks.

Successful exploitation requires valid user credentials (but see 1).

The vulnerabilities are confirmed in version 2.7 flat file edition
but not in version 2.7 MySQL edition. Other versions may also be
affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
that authentication is done correctly.

PROVIDED AND/OR DISCOVERED BY:
rgod

ORIGINAL ADVISORY:
http://www.milw0rm.com/exploits/2953

TITLE:
Apple Mac OS X Quicktime/Quartz Composer Information Disclosure

SECUNIA ADVISORY ID:
SA23438

VERIFY ADVISORY:
http://secunia.com/advisories/23438/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
From remote

OPERATING SYSTEM:
Apple Macintosh OS X
http://secunia.com/product/96/

DESCRIPTION:
A vulnerability has been reported in Mac OS X, which can be exploited
by malicious people to gain knowledge of sensitive information.

The problem is that unsigned Java applets are able to use Quicktime
for Java and Quartz Composer to upload images which may potentially
contain sensitive information.

The vulnerability is reported in the following versions:
* Mac OS X v10.4.8
* Mac OS X Server v10.4.8

Systems prior to v10.4 are reportedly not affected.

SOLUTION:
Apply Security Update 2006-008.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Geoff Beier.

ORIGINAL ADVISORY:
http://docs.info.apple.com/article.html?artnum=304916

TITLE:
Linux Kernel "mincore()" Deadlock Denial of Service

SECUNIA ADVISORY ID:
SA23436

VERIFY ADVISORY:
http://secunia.com/advisories/23436/

CRITICAL:
Not critical

IMPACT:
DoS

WHERE:
Local system

OPERATING SYSTEM:
Linux Kernel 2.4.x
http://secunia.com/product/763/

DESCRIPTION:
Doug Chapman has reported a vulnerability in the Linux Kernel, which
can be exploited by malicious, local users to cause a DoS (Denial of
Service).

The vulnerability is caused due to an error within the handling of
locking semaphores in "mincore()". This can be exploited to cause a
deadlock by using the function on unmapped pages.

SOLUTION:
Update to version 2.4.33.6.

PROVIDED AND/OR DISCOVERED BY:
Doug Chapman

ORIGINAL ADVISORY:
http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.6

TITLE:
WinFtp Server Data Handling Denial of Service Vulnerability

SECUNIA ADVISORY ID:
SA23412

VERIFY ADVISORY:
http://secunia.com/advisories/23412/

CRITICAL:
Moderately critical

IMPACT:
DoS

WHERE:
From remote

SOFTWARE:
WinFtp Server 2.x
http://secunia.com/product/12923/

DESCRIPTION:
shinnai has discovered a vulnerability in WinFtp Server, which can be
exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an off-by-one error when
processing data received from the client. This can be exploited to
crash the service by sending an overly long string (greater than 500
bytes) to the service.

The vulnerability is confirmed in version 2.0.2. Other versions may
also be affected.

SOLUTION:
Restrict access to the FTP service.

PROVIDED AND/OR DISCOVERED BY:
shinnai

Advisory ID : FrSIRT/ADV-2006-5070
CVE ID : GENERIC-MAP-NOMATCH
Rated as : Moderate Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-12-20

A vulnerability has been identified in Nortel CallPilot. This issue is due to an unspecified error with an unknown impact and unknown attack vectors.

Affected Products

Nortel CallPilot versions 4.x

Solution

Apply patch :
http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=363252

References

http://www.frsirt.com/english/advisories/2006/5070
http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=363252

Credits

Vulnerability reported by the vendor

TITLE:
Red Hat update for thunderbird

SECUNIA ADVISORY ID:
SA23439

VERIFY ADVISORY:
http://secunia.com/advisories/23439/

CRITICAL:
Highly critical

IMPACT:
Cross Site Scripting, DoS, System access

WHERE:
From remote

OPERATING SYSTEM:
RedHat Enterprise Linux AS 4
http://secunia.com/product/4669/
RedHat Enterprise Linux ES 4
http://secunia.com/product/4668/
RedHat Enterprise Linux WS 4
http://secunia.com/product/4670/

DESCRIPTION:
Red Hat has issued an update for thunderbird. This fixes some
vulnerabilities, which can be exploited by malicious people to
conduct cross-site scripting attacks and potentially compromise a
user's system.

For more information:
SA23420

SOLUTION:
Updated packages are available from Red Hat Network.
http://rhn.redhat.com

ORIGINAL ADVISORY:
http://rhn.redhat.com/errata/RHSA-2006-0760.html

OTHER REFERENCES:
SA23420:
http://secunia.com/advisories/23420/

TITLE:
Red Hat update for firefox

SECUNIA ADVISORY ID:
SA23440

VERIFY ADVISORY:
http://secunia.com/advisories/23440/

CRITICAL:
Highly critical

IMPACT:
Cross Site Scripting, System access

WHERE:
From remote

OPERATING SYSTEM:
RedHat Enterprise Linux AS 4
http://secunia.com/product/4669/
RedHat Enterprise Linux ES 4
http://secunia.com/product/4668/
RedHat Enterprise Linux WS 4
http://secunia.com/product/4670/

DESCRIPTION:
Red Hat has issued an update for firefox. This fixes some
vulnerabilities, which can be exploited by malicious people to
conduct cross-site scripting attacks and potentially compromise a
user's system.

For more information:
SA23282

SOLUTION:
Updated packages are available from Red Hat Network.
http://rhn.redhat.com

ORIGINAL ADVISORY:
http://rhn.redhat.com/errata/RHSA-2006-0758.html

OTHER REFERENCES:
SA23282:
http://secunia.com/advisories/23282/

Affected Products: ESET NOD32 Antivirus
Vulnerability: Arbitrary Code Execution (remote)
Risk: HIGH

Vendor communication:
2006/08/24 initial notification of ESET
2006/08/28 ESET Response
2006/08/29 PGP keys exchange
2006/08/29 PoC files sent to ESET
2006/09/06 ESET initial feedback.
2006/09/08 ESET confirmed the bug and fixed
2006/09/08 ESET made available the updates

Description:
Multiple vulnerabilities have been found in the file parsing engine.

In detail, the following flaw was determined:

- Divide by Zero in .CHM file parsing.
- Heap Overflow through Integer Overflow in .DOC File Parsing

The .DOC problem can lead to remote arbitrary code execution if an attacker carefully crafts a file that exploits the aforementioned vulnerabilities.
The vulnerabilities are present in NOD32 Antivirus software versions prior to the update v.1.1743.

Solution:
The vulnerabilities were reported on Aug 24 and an update has been issued on Sep 08 to solve these vulnerabilities through the regular update mechanism.

Reference: http://www.securityfocus.com/archive/1/454949 (advisory published Dec. 20, 2006)